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MEMORANDUM FOR; 
FROM : 

SUBJECT : 

REFERENCES : 


Director of Security 

Clifford D. May, Jr. 

Director of Data Processing 

Computerised Database - Areas Approved 
Storage of Collateral and SCX Material 


25X1 


a. Memo to D/ODP fm D/OS dtd 27 Jan. 11 , 
same subject. 

b. Memo to D/OS fm D/ODP dtd 25 Feb. 77, 
same subject. 


that Jun 


XV ! li 


]mv previous memorandum (reference b.) stated 

__ _ Jas the earliest date that ODP would have 

personnel available to work on your request. However, an^ 
analyst from B Division of A pplications is now available to 
beg ill work on this proj ect. ' 

Division. 


has contacted 


J of the Special 


u jx. v a.oa.'-'ii g *. i i — # 

Security Center to begin a preliminary study of your require- 
ments . 


]25X1A 
25X1 A 


2 . 


^ {After analysing the requirements of the proposed 
Storage Facilities system wa have concluded that we could 
readily implement it using OOP's central computers. However, 
a significant resource commitment is required to collect the 
necessary data and enter it into the data base. V7a have pre- 
pared an analysis of the data collection and preparation tas^.o 
and recommended procedures to obtain, me data necessary xor 
the svstera. These are contained in the attached study. 


3. 


because there is a significant resource commit- 


ment required' of Security, ODP , and other .agency components. 


I recommend that 


jl mav, J coordinate the review of this 

study with those people identified in paragrapn 1. of the 
attachment. Before you and i approve ODP s continuing witn 
the system development, v?e should be certain that we agree 
with the findings and recommendations of the attached study . 

If you concur with the study's recommendations and want ODP 
to continue work on the schedule provided in the study, please 
sign below. 
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4- I ll I has been assigne d respon sibility 


for this project and may be reached on ext 


or your staff have any questions ct„ 


Att: a/s 



if you 25X1 A 


25X1 A 


CONCUR; 


Director’ o f ~S e c ur i t y Date 


CC: C/BD/ODP 
C/AS/O DP 
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STORAGE FACILITIES DATA BASE 
(STORFAC) STUDY REPORT 


References: (1) Memo fr[ 


I CD/ODP, dtd 16 Nov 77, 25X1 A 
subject: Requirements Def yri icLoa, for 
Storage Facility Data Base 


25X1 


(2) Memo fr Chief, Compartmented' Information 
Branch, DD/P6M/OS , dtd 15 Jan 77, subject: 

Top Level Requireme nts for Storage Facility' 

Data Base II 25X1 


-*-• Agency personnel who have an interest in the 

° tor age Facilities Data Base Concept presented in References 
1 and 2, met during the month of December 3977. The following 
inidividuals were present: 


- C/CIB/SSC/OS 

- ISB/PSD/OS 

- OD&E Security Staff 
“ ODScE Security Staff 

- OL Security Staff 

- C/BD/ODP 

- CD/ODP 

- C/SMS/DDS&T 

“ NFAC Security Staff 

- CSD/OC 

- C/ISSG/OS 


The references had been studied prior to the meeting. The 
data base concept was thoroughly discussed. The final outcome 
of the meeting was a general concurrence that such a system 


is needed, general agreement 
be collected and maintained. 


on the types of data which should 
and satisfaction with the formats 
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data 


and y G^-BR!?^P(^ft^R^8fiO()^Mft5r7c o a . The 

t • 

elements which would be needed to support the system are listed 
in Reference 1. Report formats are detailed in Reference 2. 

The general consensus was that a system was 
needed to inventory and monitor secure storage facilities. 

It was questioned, however, whether the development should 
proceed at this time, since the Agency is currently performing 

other studies related to industrial, security practices. It 

» 

was decided that ODP should expend sufficient effort to investi- 
gate the following: 

° Where is all the data which is needed for data 
base generation currently located? 

° How can this information be gathered and reduced 
to machine readable format? 

° What input media should be used (cards, CAMSXEC, 
etc) ? 

° What are the STORFAC development costs? 

° Hoy;, long will it take to develop such a system? 

The paragraphs which follow address these questions and con- 
tain the findings of . this short study effort. 

Data which is needed to generate a Storage 
Facilities file is stored in several offices at various loca- 
tions. Some of the data sources will be relatively easy 




Approved For Release 2002/6&!'; ,CIA-RDP9&B0i l72R000900020005-7 




25X1 


Approved For Rele^fe 2002/05/07 : CIA-RDP96BO1172ROOG0OOO2OOO5-7 

to research. Some of the data is stored in voluminous 
folders and will recjuire considerable effort and some source 
familiarity in order to extract the required information. 

The primary offices which currently maintain most of the 
required information are: 

- Office of Security (OS) 

- Special Security Center (SSC) 


- Information Systems Security Group (ISSG) 

- Physical Security Division (PSD) 

Industrial Security Branch (ISB) 
Overseas Security Branch (OSSB) 
Domestic Security Branch (DSB) 
Technical Security Division (TSD) 

- Office of Logistics (OL) , Security Staff 
Office. of Communications (OC) 

Communications Security Division (CSD) 


25X1 A 



Additional data sources may be identified as the development 
effort progresses. 


4 * Information on approximately 1,200 active storage 

locations is maintained in SSC. This information is logged 
and maintained on manual, records (5x7 index cards) . Each 
card contains datci for one location. Data values on the 
index cards are labeled and, therefore, would be relatively 
easy to extract* The following information is normally 


^ i ;■ ; t 5 
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° Facility Name 
° Activity Indicator 
° Facility Location 
° Cover 

° SPECLE Number (assigned by SSC) 

° Agency Interest' 

° Security Officer w/telephone number 
° Alternate Security Office w/ telephone number 
° Responsible Agency, Component, Division, Contract Team 
° Type of Operation - 

° Facility Clearance Level 

° Accreditation Date ' ’• 

° Special Activities 
° Associated SCI Projects 
° Comments 


5. 


The OL Security Staff maintains 


approximately 


1,900 contract folders. About 600 of these folders are main- 
tained for active contracts/contractors. The folders contain 


all the information concerning the contract that a vendor has 
with. the Agency. In addition, the folder has information 


regarding the contractor facility in which classified informa- 
tion is stored and/or produced. These folders are for facili- 
ties which meiy or may not be the same as those facility index 


cards maintained by SSC. Detailed examination of these folders 

v/ould normally yield the following data items: 

° Facility Name 
° Facility Location 
° Clearance Level 
° Sterility Code 

° Security Officer w/telephone number 
° Alternate Security Officer w/telephone number 
° Security Survey Date (s) 

0 Component/Division/Team Responsible for the Facility 
Extraction of the data from the OL Security Staff contract 


4 
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folders would bp' fairly difficult. This » jld be true even if 
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the researcher had a limited familiarity with the contents of 
the folder. This is primarily due to the quantity of data 
stored for a particular contract. 

The OS/PSD maintains folders on approximately 


6 . 


1 active stations located around the world. Information for 


most of the facilities (stations) maintained by PSD is also 
located on the 5x7 index cards kept by SSC. In addition to 
data which describes and locates a station, the folders 
identify storage type, cover and type of operation. Also, 
they specify the historical security survey and security audit 
dates which are required for development of 5T0P.FAC. These 
folders contain a considerable volume of data and would require 
some degree of f amiliarity with the contents in order to re- 
search and retrieve the necessary historical information. 

7. 


of ficers maintain data 


The OC, CSD and 
for installations on which a COMSEC or TEMPEST survey is to 
be or has been conducted. Information on COMSEC and TEMPEST 
surveys is maintained and readily accessible in CSD and | ] 

on chronological lists which identify the facility and specify 
the latest survey dates. 

8. OS/ISSG maintains a data file which contains 

records on approximately | [ computer facilities. These 
computer areas are primarily located at contractor facilities. 
Information in this data file consists of the following : 


■i A 1 
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° Facility Name 
° Facility Location 
° Clearance Level 

° Responsible Component/Division/etc . 

° Date of latest computer Facility Inspection 
. Identification of the types of Comouting Equipment 
w/vendor 

This data is processed periodically to produce tabular reports 

in several different sequences (Location, Facility Name, etc.). 

It would be relatively easy to research and extract data for 

•» 

inclusion in the STORFAC data base. 

9* TSD maintains information concerning the 

dates on which an ACM survey was conducted at a specific facility. 
This information is readily available for extraction and 
inclusion in the STORFAC. data base. 

10. The primary problem which must be solved in 

order to develop the STORFAC data base is how to collect, 
edit, collate, and enter the information which is available 
at the various sources. A procedure must be developed v;hich 
will either (1) allow all available data to be collected, 
collated and edited for each unique facility prior to intro- 
duction to the data base; or (2) allow for incremental develop- 
ment. After considering both approaches, it is suggested 
that the second approach be considered for the development 
effort. An incremental approach would allow for development 
of a partial data base which would contain partially complete- 
records. Subsequent operations would supply additional facili- 
ties not currently included in the SSC files and provide the 


G 
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necessary infor' 'tion which would make tin martially completed 
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records complete. Figure 1, pages 1 through 7 is a flow 
diagram of the suggested approach . 

11 . 


hny attempt to assemble all the necessary infor- 


mation prior to data base generation would require a signifi- 
cant redundant effort to code information at the various data 
source locations. In addition, it would place a tremendous 
burden upon SSC to collate all the data for a unique, facility 
prior to its introduction to the data base. 




7 

77 \':y”: ; v •’ 1 
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1 2 Approved i-or beg in 


in the SSC of the Office of Security- Data from each of the 
1,200 index cards would be examined. Data items required in 
the STORFAC data base which are available in SSC would be 
entered on a Delta Data terminal using a CAMEXEC menu. Figure 
2 is a copy of the menu which identifies those data items 
input by SSC. Edit routines would be invoked, where applicable 
to ensure that the data entered conformed to acceptable formats 
ranges and values prescribed by SSC. After the data passes 
the applicable edits, it will be stored in a transaction disk 
file. Periodically (perhaps once or twice a week) , the trans- 
action data would be batched into a job stream which would 
invoke the File Maintenance (FM) module of NIPS. This trans- 
action information would be used to generate (first time) or 
add to the STORFAC data base. 

After each FM process, SSC would be provided 


13, 


with an audit trail report which would consist of ci formatted 
dump of the content of each STORFAC facility record which was 
added to the file or changed in any way during the FM run. 
This activity would continue until datei from all 1,200 index 
cards had been extracted and entered into the file. At this 
point in time, a partially complete STORFAC data base would 
be available for processing by SSC. However, this file would 
only contain partially completed data records. The other 
information needed to make each facility record complete re- 
sides in the other offices identified in paragraph 1 of this 
report „ 

15 
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evelop- 

ment effort, the data residing in the STORE’ AC data base would 
be extracted, sorted and processed to produce a master report 
similar in appearance to the CAMEXEC menu used for data intro- 
duction. The sequence of this report would be in facility 
name order. Only data for one facility xvould appear on each 
printed page of the report. At the same time, one line per 
facility cross index listings would be produced to assist 
the other offices who will be contributing data in their 
facility research and identification activities. The cross 
indices could be provided in facility location by State, 

SPECLE Number, etc. orders, as considered necessary for 
identification purposes. The master report format would con- 
tain all of the known (previously entered by SSC) data together 
with sufficiently labeled space for that information not 
currently in the data base. 

A quantity of blank forms similar to the 


•15. 


CAMEXEC menu would be produced for use by the offices other 
than SSC, to enter data for facilities not currently resident 
in the STORrAC data base. These forms would have space for 
all the required data fields with labels for data entry. 

The master report, cross .index reports and 


16 


a supply of blank menu forms would then be forwarded to the 
OL Security Staff for their inputs. 


17 
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Each of the 600 folders 


active contracts 
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roust be researched in OL." If the folder is for a facility 
already in the STORE AC data base, additional items of in forma- 
tion (dates, etc.) must be extracted and entered in the appro- 
priate space on the partially complete master report pcige for 
that facility. If the folder is for a facility not currently 
in the STORFAC data base, one of the blank forms must be com- 
pleted. All applicable data in the folder must be extracted 
and entered. Figure 3 identifies those data values which 
would be supplied by the OL Security Staff folder research 
effort. 


18. 


When all 600 contract folders have been 


researched, the partially completed forms, the blank menus 


and the cross index listings will be forwarded to Physical 


Security. The records in PSD would be researched, data ex- 
tracted and entered on the forms in the same manner as the 
process accomplished in OL. (Figure 4 identifies those data 
values which would be supplied by the PSD folder research 
effort.) -When all PS facility records have been exhausted, 
the forms and index reports will be forwarded to TSD where the 
process .is repeated (Supply ACM dates for existing STORFAC 
records, create new forms for previously not identified facili- 
ties.). When . the TSD activity has been completed, the entire 
package will be passed to ISSG for their delta extraction process 
When the ISSG extraction effort is finished, the package is 
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passed to OC/CS aid 

Approved F^Jjtele 


BfX-RSi^eiko 1 P rocess 

is repeated. When complete, OC will return the entire package 

to SSC. (Figure 5 identifies those data values which would be 

supplied by TSD; Figure 6 identifies those data values supplied 

by ISSG; and Figure 7 identifies the data values supplied by 

OC/CSD and 




19. 


Upon receipt of the package from OC, the final 
stage of incremental development can begin.- Each facility form 
must be examined to determine if it is a new facility (not one 
of the original 1,200 SSC records) or if it is one of the 
original SSC facilities. If it is a form for a new facility, 
SSC must determine its SPECLE Number and assign a machine 
reference number (MRN) . Since the MRN is the record control 
element for STORFAC, care must be exercised to ensure that 
this MRN is unique from all others. When these two data 
fields have been completed, the information can be entered via 
the CAMEXEC menu and transactions created and stored on the 
transaction file. 

20 . 


If the form is for one of the original 1,200 
facilities, the data added by OL, PSD, ISSG, TSD, and OC would 
be entered via the CAMEXEC menu and stored with the transactions 
produced in the previous step. When all information has been 
entered, the transaction data would be batched into an FM job 
stream and the STORFAC file updated . At this point, SSC should 
be in control of a complete Storage Facilities Data Base. It 
is suggested that Master Format Reports be produced for each 
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of the major data contributors. As new survey are conducted, 
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new feicilities identified' and errors found in the data base, 

blank forms similar to the CAMEXEC menu can be used to forward 
new or changing information to SSC for inclusion in the data 


base . 


21 . 


The previous paragraphs briefly describe a 


suggested process which could be used to incrementally develop 
the STORE AC data base. The pages which follow estimate the 
costs for this effort. Costs are identified for Agency re- 
search and entry effort in working days, software development 
in working days and machine costs in terms of computer usage 
and terminal hook-up costs. 


22 . 


The cost for the ongoing File Maintenance 


activities which will be required to keep SuORFAC current are 
difficult to determine. It is estimated that the data base 
would normally be updated on a weekly basis. This process 
would be required to enter data for new facilities and \ipdate 
information on existing facilities. In addition, it is assumed 


that there would be approximately 2 report production runs 


per week. Each File Maintenance run will require approximately 
1 minute CPU time at a cost of $22 per run. Each report pro- 
duction run will require approximately .5 minute CPU time at 
a cost of $11 per run. Computer usage costs will be billed to 
ODP . The cost for data extraction and terminal entry will 
depend upon the amount of activity associated with introduction 


2 5 
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performed by the various teams and offices. Terminal hook-up 
time for entry of a new facility will be in the range of 5 to 
10 minutes. Hook-up time for entering new data on an existing 
facility will depend upon the amount of data being added. This 
should not exceed more than 5 minutes per facility. 

23 * The P a 3 es ^ich follow provide an estimate for 

the various costs associated with STORFAC development. Figure 
8 presents the estimate for programmer effort associated with 
software development which would be charged to the OOP budget. 
Figure 9 provides an estimate of the machine costs for software 
and data base development activities which would be charged to 
the ODP budget. Figure 10 is an estimate of the number of 
work days which would be required to extract and enter the 
data via a terminal using a C AMEX EC menu. Figure 11 is a 

schedule for STORFAC development in terms of calendar weeks 
per task. 


26 
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Software Development Cost Estimates 


CAMEXEC MENU W/EDITS 

NIPS FILE ANALYSIS & DESIGN 

FILE MAINTENANCE LOGIC 
(Design, Code, Test) 

SSC DESIGNED REPORTS (6) 

AUDIT TRAIL REPORT 

DUPLICATION OF CAMEXEC MENU REPORT 
CROSS INDEX REPORT 
FILE GENERATION & TEST 
NIPS SOFTWARE DOCUMENTATION 
USER TRAINING & MONITORING 
COVERSION TABLES 


22 work days 


TOTAL 


89 work days 


Note: This translates into approximately $10,800 

Q $600 per work week. 

(18 wk x $600 = $10,800) 


Figure 8. Programmer Software Development Cost Estimates 
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MACHINE COST ESTIMATES 


SOFTWARE DEVELOPMENT COMPUTER COST 
(approx. 1 hour CPU time) 

SOFTWARE DEVELOPMENT TERMINAL HOOK-UP COST 
(approx. 200 hours @ $12 hour) 

COMPUTER COST FOR FILE GENERATION & 

REPORT PRODUCTION DURING INCREMENTAL 
DEVELOPMENT 

(approx. .5 hour CPU time) 

TERMINAL HOOK-UP TIME FOR SSC D7\TA ENTRY 
DURING INCREMENTAL DEVELOPMENT 
(75 facilities per day = 320 
hours at $12 per hook-up hour) 


$1/300 
$2/400 
$ 650 


$3,840 


TOTAL MACHINE COST 


$8,190 


Figure 9. Machine Cost Estimates 
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TEEMS OF WORKING DAYS 


SSC ORIGINAL DATA EXTRACTION & 
CAMEXEC ENTRY TIME 

OL DATA EXTRACTION 

PSD DATA EXTRACTION 

TSD DATA EXTRACTION 

ISSG DATA EXTRACTION 

OC/CSD f | DATA EXTRACTION 


SSC CAMEXEC ENTRY OF NEW 
FACILITIES & ADDITIONAL DATA 


20-25 person work days 


20-30 

20-30 

10-15 

10-15 

10-15 

20-25 


TOTAL 


110-155 person work days 


Note: If records must be researched in other offices, the 

deita extraction work day costs must be increased 
proportionately. 


Figure 10. Data Extraction Cost Estimates 
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